> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Incident Memory

> AI that learns from past incidents to investigate new ones faster

Every incident your team resolves makes CloudThinker smarter. **Incident Memory** automatically captures lessons from completed investigations and applies them when similar incidents occur in the future.

***

## How It Works

<Steps>
  <Step title="Investigation Completes">
    When an RCA investigation identifies a root cause, CloudThinker automatically extracts key learnings — the problem, root cause, remediation steps, affected services, and confidence level.
  </Step>

  <Step title="Memory Stored">
    CloudThinker automatically stores these learnings for future use.
  </Step>

  <Step title="New Incident Occurs">
    When a new incident triggers an RCA investigation, CloudThinker searches for similar past incidents across your workspace.
  </Step>

  <Step title="Knowledge Applied">
    Relevant past investigations are provided to the AI agent as context, helping it focus on the most likely causes and skip dead ends.
  </Step>
</Steps>

***

## What Gets Captured

Each completed investigation automatically saves:

| Information           | Example                                                         |
| --------------------- | --------------------------------------------------------------- |
| **Root Cause**        | "Connection pool exhaustion due to leaked database connections" |
| **Remediation Steps** | Prioritized actions the AI recommended                          |
| **Affected Services** | Services involved in the incident                               |
| **Severity**          | Incident severity level                                         |
| **Confidence**        | How certain the AI was about the root cause                     |

***

## Recall Indicator

When an investigation uses knowledge from past incidents, you'll see a badge on the RCA results:

> **Informed by N similar incidents**

This tells you the AI referenced prior investigations to guide its analysis. Hover over the badge for details.

***

## When Memory Helps Most

<CardGroup cols={2}>
  <Card title="Recurring Issues" icon="rotate">
    Database connection problems, memory leaks, deployment regressions — patterns that repeat get diagnosed faster each time.
  </Card>

  <Card title="Similar Root Causes" icon="code-compare">
    A CPU spike in Service A caused by a config change? Next time a CPU spike hits Service B, the AI knows to check configurations first.
  </Card>

  <Card title="Team Knowledge Retention" icon="users">
    When engineers leave or rotate, their debugging insights stay in the system.
  </Card>

  <Card title="Faster Resolution" icon="bolt">
    Instead of starting from scratch, the AI begins with informed hypotheses based on what worked before.
  </Card>
</CardGroup>

***

## How It Improves Over Time

Incident Memory gets smarter as your team uses CloudThinker:

* **Reinforcement** — When the same root cause appears across multiple incidents, that pattern is strengthened and prioritized in future searches
* **Supersession** — Re-investigating an incident replaces the old memory with updated findings, keeping knowledge current
* **Deduplication** — Identical findings are automatically merged rather than duplicated

***

## Configuration

Incident Memory is **enabled by default** when your workspace has the memory feature active. No additional setup is needed.

<Note>
  Incident Memory only captures learnings from RCA investigations that reach a conclusion (root cause identified, false alarm, or not found). Cancelled or failed investigations are not stored.
</Note>

***

## Best Practices

* **Provide detailed incident descriptions** — richer context helps the AI find better matches from past incidents
* **Run RCA to completion** — investigations that reach a disposition contribute the most useful memories
* **Connect your topology** — incidents with mapped affected services produce more precise future matches
* **Re-investigate when needed** — running a second RCA on the same incident updates the memory with better findings